A control system, for example onboard a motor vehicle, is connected to a data bus via which it can communicate with other control systems or control devices. Some of these control devices or systems can fulfil the control functions which are relevant for the safety of an operating or uninvolved person in the environment. For example, a combustion engine or a braking device can be controlled onboard a motor vehicle. If there is a malfunction in one of the control systems or devices, it must be ensured that via the data bus, no data is transmitted which impair the operation of another control system or device and can thus compromise the safety of a controlled process.
The data bus can comprise, for example, a CAN bus. A control device of the control system is connected to the CAN bus by means of a driver chip. The control device is configured to automatically detect a fault state and to switch off the driver chip in the case of a fault. For this purpose, a dedicated output of the control device is connected to a corresponding enable input of the driver chip. To increase the security, a further control device can be provided which monitors certain operations of the first control device and detects a fault state. If a fault state is detected, the second control device switches the driver chip off via its enable input. This requires a logical combination of the shutdown signals of both control devices. In addition, a driver chip must then be used which has an enable input brought outside.
If the driver chip is switched off, the driver chip usually delivers a fault signal to the first control device. The first control device or the other control device must then usually determine the reason for the shutdown. This can mean a fault in the first control device, a fault in the second control device and a fault in the driver chip. Additionally, connections or combinations of signals can be faulty. Finally, the fault signal itself can also be faulty. In order to correctly allocate the fault, different signal paths between the control devices and the driver chip must therefore be checked. This checking can be elaborate and necessitate that signals are output on the data bus which are only used for determining the fault and are not directed to another control device or system.